Last month, Pando reported that an Uber driver in San Francisco had been accused of verbally and physically assaulting a passenger, James Alva. According to Alva, the driver called him a "dirty Mexican faggot" and then struck him several times when Alva tried to take a photo of him and his license plate to send to Uber.

The company confirmed that the alleged attacker was an Uber driver. However, since the police did not arrest the driver when called to the scene, the company chose not to investigate the incident further. At the time, Uber said it would temporarily suspend the driver, but not permanently ban him from driving for the company. [Updated: Since this post was published, Uber emailed to say the company deactivated this driver's account from the system in December. Uber has not yet commented as to what prompted this change of heart.]

Throughout, Uber insisted that the driver had passed their standard background checks.

However, Pando has since learned that the driver -- 28-year-old San Francisco resident Daveea Whitmire -- has a criminal record, including felony and misdemeanor charges, and at least one felony conviction involving prison time. How, or why, Uber missed -- or ignored -- this criminal history is unclear.

Here are the facts: In 2009 Whitmire received a felony conviction for selling marijuana and was sentenced to prison time. In 2012, he was arrested again and charged with another felony for buying cocaine to resell, and a misdemeanor for resisting a public officer. In April 2013 Whitmire missed a preliminary hearing for his case, prompting a judge to forfeit his $100,000 bail and issue a warrant for his arrest.

The most recent record is from his probation officer on October 29, 2013, requesting that Whitmire’s probation be revoked due to an unspecified violation. The petition was filed a mere four weeks prior to Whitmire driving for UberX and allegedly attacking James Alva.

Whitmire’s criminal records are public, available in the San Francisco courthouse for those willing to request them. And yet, not only did Uber seemingly miss them, but after the Alva assault case came to light the company published a statement citing its background checks as proof of its commitment to safety. Speaking today, an Uber spokesperson told me "We have a zero-tolerance policy for drugs and alcohol offenses."

However, when I asked specifically about Whitmire, the spokesperson declined to comment further and instead asked me to send further questions by email. They then called back to ask us to send over our copies of Whitmire's court records.

Updated: Here is Uber's response:

Uber works with Hirease to conduct stringent background checks, which all drivers must undergo and clear to partner with Uber. This driver had a clean background check when he became an Uber partner in October. Uber maintains a zero tolerance policy for any alcohol and drug-related offenses on any background check with any partner nationwide, unlike, for example, the taxi industry in San Francisco, which permits drivers with DUIs and drug offenses.

By Uber's own admission, the company ran Whitmire through a background check this past October. But his first felony charge occurred in 2009 and his second felony and misdemeanor charge happened in 2012. [Updated: We were unable to reach Daveea Whitmire for comment.]

So the question remains: How did Whitmire slip through the net? And why was a driver who has served prison time for a felony merely “suspended” by Uber after the alleged assault? Why didn’t the benefit of the doubt go to the passenger who captured some of the incident on his iPhone?

* * *

According to experts, there are two reasons a background check might have overlooked Whitmire's records. "One [reason] is that they're not doing [checks] at all which is possible. It's very possible," private investigator Brian Willingham tells me. "Or, they're doing such shitty background checks it won't come up." Willingham has 12 years of experience as a P.I., and he currently runs the investigative firm Diligentia Group. [Updated: following the original publication of this post, Uber confirmed they use Hirease for their background checks.]

National background checks vary wildly in quality, scope, and validity. "A background check is whatever you want to call it. It's not necessarily a particular set of instructions," Willingham says. "You can do anything from $15 background checks, to billing out a client for $100,000 background checks which involve digging into every piece of dirt in a person's past."

Anyone could buy a $15 background check off the Internet that simply searches available online records. But not all court records in all states are online for the public. In fact, in San Francisco public records can only be retrieved in person at the courthouse. As a result, cheap, unofficial background checks can easily miss crucial information and prior convictions.

Ridesharing startups don't have the oversight of traditional taxi companies in California. In most major cities, taxi companies are required to do Live Scan, fingerprint-based background checks of their drivers through the Department of Justice and FBI systems. According to William Rouse, the former President of the Taxicab, Limousine & Paratransit Association, the background check results go straight to the transportation regulatory agencies for vetting, not just to the taxi companies themselves.

In addition to combing official databases, the Live Scan also updates after the fact. If a driver gets arrested for raping someone after being hired, the company will be notified. In contrast, other background checks are a static picture in time.

"The driver has a criminal record, including felony and misdemeanor charges, and at least one felony conviction involving prison time.”

"The reason this is important is because sometimes taxi drivers do get DUIs and we want to pull them out of service immediately," William Rouse, the former President of the Taxicab, Limousine & Paratransit Association, says. "But you can't necessarily rely on the driver to tell you that happened."

The cost of a Live Scan ranges depending on the agency that performs it and how many databases an employer chooses to check (the DOJ, FBI, and Child Abuse Central Index). On average, the full scan for one person costs $70-$80.

"People do background checks because it sounds like good PR," private investigator Willingham says. "But at the end of the day, your background check is only as good as what you're going to put into it.”

Jordanna Thigpen, a trial lawyer in Los Angeles and the former Executive Director of the San Francisco Taxi Commission, hadn't been following the recent ridesharing legalization in California. She was shocked to find out the CPUC hadn't dictated Live Scans for the background checks. "The Live Scan is really the only way to accurately tell who you're hiring," Thigpen says. "I can't believe that the DOJ requirement isn't what they meant. I just can't believe that."

The San Francisco Municipal Transportation Authority (SFMTA) registered exactly that complaint with the CPUC back in August. In a letter, the SFMTA director said:

In light of the SFMTA’s longstanding use of fingerprinting and Live Scan background checks, a Commission decision that applies a lower standard to TNC [ridesharing] drivers could produce the unintended consequence of populating the TNC driver pool with candidates who have been rejected as taxi driver applicants precisely because of their criminal histories.

However, the CPUC didn't listen, ridesharing companies reportedly don't do Live Scans (when asked directly if they did Live Scans, an Uber spokesperson declined to comment), and drivers like Daveea Whitmire, with prior felonies including for drug offenses, can slip through the cracks.

* * *

Another reason Uber might have held back on firing the driver is because the company is struggling with supply and demand issues. There frequently aren't enough drivers for all of Uber's customers, leading to controversial policies like the company's surge pricing scheme.

Uber is not alone in struggling to scale -- the supply-demand problem plagues all ridesharing companies. For customers to rely on these new transportation technologies, the service must be reliable, with plenty of cars always on the road. But building such a network from the ground up is no small feat, and we're seeing ridesharing companies face these scaling pains more and more. Lyft recently rolled out its own version of surge pricing, called Prime Time Tips, for exactly the same reason as Uber: Not enough drivers during busy hours.

But a strategy of treating driver supply as more important than customer safety could backfire for transportation networking companies. For a startup that argues cities don’t need government regulated ways to get around, the public perceptions of Uber matter. Especially when many cities and taxi groups are begging for a reason to sway public opinion into the anti-Uber camp. And especially when Uber is rumored to be priced at an absolutely do-no-wrong $4 billion valuation.

At what point does Uber recognize the safety of its customers is not only “its problem,” but a real threat to its growth?

**

Seth Bender was the first alleged Uber driver assault victim to make the news. He grabbed an Uber in D.C. at the corner of 9th and U streets NW. When he burped and excused himself, the driver allegedly began screaming about how he hated homosexuals, spit in Seth's face, then slapped him.

Monica (not her real name) was the second. She told police that when she was exiting the car, her driver grabbed her, causing her to fall and hit her head. She said he then raped her. The prosecutors dropped the charges due to conflicting evidence, even though D.C. police thought the case was strong.

Bridget Todd, who has written for publications ranging from The Atlantic to Jezebel, was the third. She kissed her husband in the back of an Uber car, inciting the ire of the driver. She tweeted that he followed her out of the car and choked her.

In nearly all of these cases, Uber has responded in the same way, saying it's not responsible for the conduct of its drivers. CEO Travis Kalanick shared his response to press reports in an internal company email, published by Gawker: "[F]or whatever reason these writers are starting to think that we are somehow liable for these incidents that aren't even real in the first place."

That statement is odd. Kalanick wouldn’t be the first Valley CEO to plead “we’re just a platform” to distance itself from liability. But “Incidents that are even real in the first place”? That’s a hell of a leap for someone not in the car to make.

Alva was in a daze after his encounter with Uber driver Daveea Whitmire, but what he found even more unsettling than the attack was Uber's response to the situation.

Alva claims the company’s San Francisco community manager Matthew Hearns called the next morning and showed no remorse for what had happened. In fact, Alva says Hearns never once apologized or even asked him for his version of events. Instead, Hearns brusquely explained that Uber would comply with any law enforcement investigation but would not conduct an inquiry of its own. The driver would be suspended, but not terminated.

"What's it like when a company you think has your best interests at heart really doesn't?"

Speaking at the time, an Uber spokesperson gave me a similar brush-off, asking: "[W]hat would you propose that we do? [W]e’re a technology platform that connects riders and providers, so it’s not our job to investigate.”

Despite Kalanick’s protestations, Uber isn’t a free-for-all platform. Unlike businesses like eBay or Craigslist where anyone can list merchandise, Uber supposedly has strict quality control. Drivers without criminal records are routinely kicked out of the service just for getting negative customer reviews.

Liability is a touchy subject for Internet companies. Content sites have already successfully lobbied for their liability to be limited by federal law. Section 230 of the Communications Decency Act states, "No provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider."

In other words, since Internet Service Providers are the conduits for the information and not the creators, they’re free from legal repercussion.

The law is championed by free speech organizations like the ACLU and the Electronic Frontier Foundation. Here's how the American Civil Liberties Union describes it:

"Under Section 230, a website can provide a platform for all speech without worrying that if one of its online users posts something stupid, critical, defamatory, or unlawful, the website itself can be held responsible. What does this mean for the web as we know it? Almost everything. It means that Yelp can't be held legally responsible for a negative restaurant review written by one of its users. It means Craigslist doesn't have to screen every personal ad to make sure it isn't a cleverly-disguised prostitution pitch."

Using this law, courts have time and time again ruled that Internet Service Providers aren't responsible for the words or crimes of their users, even if said crimes were facilitated through the site.

When it comes to real-world service providers like Uber, Lyft and Sidecar, the law is less clear. These companies emphasize the fact that they’re platforms matching willing drivers and passengers, not transportation providers themselves. They insist that, like these sites, this limits their liability.

It’s for that reason that Uber reportedly refuses to compensate customers for conflicts with drivers, aside from refunding the ride fare (reached for comment, the company would not confirm this policy on the record). It’s also the reason the company is loathe to publicly admit any wrongdoing alleged to have been perpetrated its drivers, often refusing to even investigate the allegations.

If prosecutors don't press charges against drivers, as was the case with Alva, Monica*, Seth, and Bridget, Uber washes its hands clean of the incident too. Drivers can be back on the road in days.

As far as we can tell, Uber is the only transportation network company whose drivers have been accused of assault. There are a few mentions of Lyft driver issues including a driver text-stalking a former passenger, and a Facebook complaint of an aggressive Lyft driver. But in those cases, Lyft responded very differently than Uber, apologizing to the rider and promising to swiftly investigate the issue.

That said, Lyft and Sidecar's terms of service both say roughly the same thing as Uber's. They preemptively defend themselves from liability behind the "we're just a platform" argument.

Uber: "For the avoidance of doubt: Uber itself does not provide transportation services, and Uber is not a transportation carrier...Uber under no circumstance accepts liability in connection with and/or arising from the transportation services provided by the Transportation Provider or any acts, action, behaviour, conduct, and/or negligence on the part of the Transportation Provider."

Lyft: " LYFT OFFERS INFORMATION AND A METHOD TO CONNECT DRIVERS AND RIDERS WITH EACH OTHER, BUT DOES NOT AND DOES NOT INTEND TO PROVIDE TRANSPORTATION SERVICES OR ACT IN ANY MANNER AS A TRANSPORTATION CARRIER, AND HAS NO RESPONSIBILITY OR LIABILITY FOR ANY TRANSPORTATION SERVICES VOLUNTARILY PROVIDED TO ANY RIDER BY ANY DRIVER USING THE LYFT PLATFORM."

Sidecar: "SIDECAR OFFERS A METHOD TO CONNECT DRIVERS AND RIDERS WITH EACH OTHER, BUT DOES NOT AND DOES NOT INTEND TO PROVIDE TRANSPORTATION SERVICES OR ACT IN ANY MANNER AS A TRANSPORTATION CARRIER, AND HAS NO RESPONSIBILITY OR LIABILITY FOR ANY TRANSPORTATION SERVICES VOLUNTARILY PROVIDED TO ANY PASSENGER BY ANY DRIVER USING THE SIDECAR PLATFORM."
Note: The capitalization is the companies' own emphasis, not mine.

If your driver attacks you, or gets drunk and runs off a cliff with you sitting next to him, these companies are telling you upfront that they're not responsible.

This wouldn't be so troubling if passengers adopted the same “buyer beware” attitude as they do with true platforms like eBay. But few do. After all, these companies stress their commitment to safety. All three promise they perform background checks to vet drivers. They take a commission off each transaction. Lastly, they regulate their drivers appearance, behavior, and service, ranging from Lyft's pink mustaches and fist bumps to Uber's clean, professional look. No one tells a guy listing Star Wars action figures on eBay to take a shower first.

To most consumers, these companies are not platforms. Many don’t even realize that Uber doesn't even consider its drivers to be company employees.

One of the four passengers whose Uber assault cases went public certainly wasn’t aware of the distinction. This person asked to be quoted anonymously because they had received death threats from Uber supporters after their case went public.

In a phone interview, this person reflected on how they used to love Uber, to the point of owning Uber t-shirts and extolling the virtues of the brand to anyone who would listen. But after their incident with an Uber driver, the company denied responsibility and tried to discredit them.

"What's it like when a company you think has your best interests at heart really doesn't?" this person asks. "I have not used Uber since that incident but I still recommend it to friends. I tell them, 'You may feel lulled into a false sense of security but you should know you're really on your own, and Uber is not on your side.'"

Gil Silberman is a managing partner at Equity LLP law firm who works with many venture-tech companies. He posts frequently on Quora about the legality of Uber, Lyft, and Sidecar. He told Pando his thoughts on the platform argument:

"It's funny for them to say, 'We're not a transportation company, we're a platform.' Thats like Peet's saying, 'We're not a coffee company, we're arranging a transaction between a barista and a customer.' If you look at what it is to provide a service: Are they doing background checks on the drivers, are they establishing standards for what kinds of cars show up, are they branding their cars with uniform look, do they do inspections on the cars? The answer to all of these is yes. If you were just arranging information between people you don't do a background check. All these things are beginning to look like these agencies are involved in the business of providing a consistent service. It's not just a Craigslist."

As transportation apps grow in popularity and legitimacy, this raises a few questions. Are startups like Lyft, Uber, and Sidecar liable in the eyes of the law for what happens when people use their application? How well do they vet their drivers? And most importantly: What responsibility are they willing to take when things go wrong?

The issue became even more urgent and pertinent following a tragic accident in San Francisco on New Year’s Eve. A 6-year-old girl -- Sophia Liu -- was hit and killed by an Uber driver while crossing the street with her mother and brother. Uber was criticized for instantly denying culpability, before the full facts of the situation were even released.

**

Since no Transportation Networking Company’s assault case has gone to trial, it's not entirely clear to what extent these tech startups are responsible for their drivers in the eyes of the courts. Like other disruptive industries, the answers will come in time, helped in part by cases like Alva’s.

Experts have some predictions about how a ridesharing assault case could play out in court. After all, Lyft, UberX, and Sidecar operate remarkably similarly to taxi providers, at least in terms of hiring. They both hire drivers as independent contractors, run background checks to vet them, and give drivers mandates in terms of appearance and behavior.

"If I were advising Uber I would try to make them seem as much as Craigslist as possible," University of California Hastings law school professor Lawrence Levine says. "But there's a difference. With Craigslist, you don't pay them money when you post an ad." [Correction: Users do pay Craigslist to post some ads, like job listings, but not others. The fee is a set amount, not a percentage cut of a transaction.]

In contract, transportation networking companies take a percentage cut of each transaction. In Uber’s case, that brings in boatloads of money. The startup’s internal revenue numbers were leaked to Gawker a month ago. The site estimated that Uber makes roughly $213 million a year, some of which goes towards the cost of operations and scaling. It’s rumored to be valued by investors at $4 billion, with Lyft valued at $275 million. Sidecar’s valuation hasn’t been leaked publicly, but we can assume it’s much less since the company has raised significantly less capital than its competitors.

According to lawyer Janelle Orsi, the rideshare fee structure may wind up being one factor the courts weigh to decide these companies’ liability. Orsi is the head of the Sustainable Economies Law Center, and she specializes in sharing and cooperative systems. “If [Lyft was] just connecting people they would only be charging for the connection,” Orsi says. “They would charge $3 per time. Not a percentage.”

Another way transportation networking companies might be held liable is for negligent hiring -- not properly screening said individuals prior to hiring them. The companies try to shield themselves from such a charge by saying their drivers aren’t employees because they’re independent contractors, a term defined by the IRS as, “A business owner or contractor who provides services to other businesses.”

But there’s a problem with this logic: Most taxi companies hire their drivers as independent contractors too. They’ve done so ever since the 1970s and 1980s to cut costs.

Since ridesharing startups partner with their drivers in a similar way to taxi companies, they too could face the negligent hiring charge if one of their drivers assaults someone. "They don't have the ability to label themselves how they wish to be labeled and then say, 'See we have no liability,'" Professor Levine says. "The law would look behind that labeling."

Likewise, ridesharing companies might face vicarious liability -- a charge that the employee was negligent while doing work for the employer. In this case, a company is liable "vicariously" since the employee represents the business.

Generally though, a company can't be charged with vicarious liability for independent contractors. And at the moment, all ridesharing companies label their drivers as independent contractors, not employees.

All this could change if a few Lyft and Uber drivers get their way. These individuals have separately filed class action lawsuits against the respective startups saying they deserve to be classified as employees, not independent contractors. The cases are still going through court. Until they are settled, ridesharing companies are unlikely to face any vicarious liability charges.

The real problem here is not that a handful of Uber drivers have allegedly assaulted their passengers. It's that there's not a good regulatory framework in place to vet those drivers in advance. Furthermore, since ridesharing companies are so new, they don’t have systems in place for handling said situations, in terms of investigating allegations and compensating victims.

Lastly, and most importantly, users don't know whether they're protected hopping in cars with ridesharing strangers. The companies have sent mixed signals about how thoroughly they vet drivers and how much they value passenger safety. When it suits them, they claim to care about safety and background checks, and when it doesn't suit them, they call themselves a platform and deny responsibility.

This is the same issue that originally faced Airbnb: Users had a sense of security through the site, one that the company wasn't originally willing to support.

Brian Chesky talked to Sarah Lacy about that at PandoMonthly a year ago. The first major incident to blow up in Airbnb's face occurred in 2011. A woman rented out her home on Airbnb and had it destroyed by meth users. The company tried to cover up the situation and pretend like it had dealt with everything, in part to avoid legal culpability.

That failed and the woman continued to go public with her story about the systematic dismantling of her privacy and her home. Eventually Chesky decided that Airbnb had to "be Airbnb" and "do what [we] think is the right thing to do," even if that meant accepting huge amounts of fiscal liability.

He publicly apologized, admitted Airbnb's responsibility in the incident, signed a check to the woman, and introduced a $50,000 insurance policy for anyone who rents their home through the service. That policy now covers $1 million in damages. As Chesky said on stage:

"I think the best thing you can do as CEO is [realize that] ultimately, as Ben Horowitz has said, everything is your fault...Good and bad, it's all your fault...So yes, we have a saying now: Put the customer first. Put the user first. Focus on love. If they love you, the best marketing is investing in user experience and then the users will market for you."

There are four billion dollars, not to mention the safety of thousands of passengers, riding on Travis Kalanick having a similar epiphany.